Password Crack-Time Estimator

Yes. The analysis runs entirely in your browser using the open-source zxcvbn library, so your password is never transmitted, logged, or stored, and you can verify that in your browser's network tab. If you'd still rather not, test a password with the same structure and length instead.

We use zxcvbn, the estimator developed at Dropbox. It doesn't just count characters: it recognises dictionary words, names, dates, keyboard walks, and common substitutions, then estimates the guesses needed and divides by realistic attacker speeds, from a rate-limited website (100 guesses per hour) to an offline attack on a leaked database (10 billion per second).

It depends on how a service stores your password. If it's hashed with a slow algorithm like bcrypt, attackers manage thousands of guesses per second. If a site stored it with a fast hash like MD5, or in plain text, the same password falls billions of times faster. You can't control that, which is why a password that survives the worst case is the goal.

Make it longer: length beats complexity. A four-word random passphrase or a 16+ character generated password beats any clever 8-character substitution. Use our free Password Generator to create one, never reuse passwords across accounts, and turn on two-factor authentication where offered.